Author Archives: Ian Burke

@MiddInfoSec: Guard Your Privacy When Offline or Traveling

Information Security has a New Twitter feed and other new content on their website. Follow us at @MiddInfosec or visit our website at http://go.middlebury.edu/infosec

Planning a spring break vacation? People are frequently more vulnerable when traveling because a break from their regular routine or encounters with unfamiliar situations often result in less cautious behavior. If this sounds like you, or someone you know, these five tips will help you protect yourself and guard your privacy.

  • Track that device! Install a device finder or manager on your mobile device in case it’s lost or stolen. Make sure it has remote wipe capabilities and also protects against malware.
  • Avoid social media announcements about your travel plans. It’s tempting to share your upcoming vacation plans with family and friends, but consider how this might make you an easy target for local or online thieves. While traveling, avoid using social media to “check in” to airports and consider posting those beautiful photos after you return home. Find out how burglars are using your vacation posts to target you in this infographic.
  • Traveling soon? If you’re traveling with a laptop or mobile device, remove or encrypt confidential information. Consider using a laptop or device designated for travel with no personal information, especially when traveling out of the country.
  • Limit personal information stored on devices. Use a tool like Identity Finder to locate your personally identifiable information (e.g., SSN, credit card numbers, or bank accounts) on your computer, then secure or remove that information.

Physically protect yourself and your devices. Use a laptop lock, avoid carrying identification cards, shred sensitive paperwork before you recycle it, and watch out for “shoulder surfers” at the ATM.

Protect Your Privacy

Information Security has a New Twitter feed and other new content on their website. Follow us at #MiddInfosec or visit our website at http://go.middlebury.edu/infosec

You and your information are everywhere. When you’re online you leave a trail of “digital exhaust” in the form of cookies, GPS data, social network posts, and e-mail exchanges, among others. It is critical to learn how to protect yourself and guard your privacy. Your identity and even your bank account could be at risk!

  • Use long and complex passwords or passphrases. These are often the first line of defense in protecting an online account. The length and complexity of your passwords can provide an extra level of protection for your personal information.
  • Take care what you share. Periodically check the privacy settings for your social networking apps to ensure that they are set to share only what you want, with whom you intend. Be very careful about putting personal information online. What goes on the Internet¬¬ usually stays on the Internet.
  • Go stealth when browsing. Your browser can store quite a bit of information about your online activities, including cookies, cached pages, and history. To ensure the privacy of personal information online, limit access by going “incognito” and using the browser’s private mode.
  • Using Wi-Fi? If only public Wi-Fi is available, restrict your activity to simple searches (no banking!) or use a VPN (virtual private network). The latter provides an encrypted tunnel between you and the sites you visit.
  • Should you trust that app? Only use apps from reputable sources. Check out reviews from users or other trusted sources before downloading anything that is unfamiliar.

Library & Information Technology Services » Post for MiddPoints 2015-10-23 12:15:34

ccam

October is Cybersecurity Awareness Month. Join your colleagues from both the Middlebury and Monterey campuses for a presentation and discussion on critical cybersecurity issues including phishing and cracking.

  • On October 29th at 12:30 Eastern time, Information Security will host a Cybersecurity Roadshow.
  • You can join the discussion in Lib105A on the Middlebury Campus or on PolyCom 710205
  • Central Monterey meeting location TBD.

Please join us for this discussion. It is open to students, faculty, staff and the community. Computer security is the responsibility of us all.

For more information call Information Security at 802-349-5805

Security Notification: Ransomware Delivered Through Phishing Attacks

A year ago the Internet saw a rash of malware known as ransomware. This malicious form of cyber attack is known for infecting a computer and encrypting a drive. The victim is then unable to recover their data until paying a ransom to the attacker. Middlebury, like many other institutions was not immune to this form of attack.

A week ago the FBI announced a new variant on a common form of these attacks known as CryptoWall. This form of ransomware is known to have four methods of infecting a computer.

  • Phishing: the attacker may lure a victim into downloading an infected attachment through a phishing campaign and thereby compromising the drive on their system.
  • Phishing: the attacker lures the victim into clicking on a link to a malicious web site where the victim unknowingly downloads the malicious software onto their system and compromises their drive.
  • Infected ad: the attacker posts and infected ad on a website which a user might click thereby causing the download of malicious software.
  • Compromised website: the attacker compromises a website so when a user visits the website they unknowingly download malicious software and compromise their system.

According to the FBI, by far the most common method of attack is phishing, particularly with attachments in the message.

What you can do to protect yourself:

  • Never open attachments or click links in emails that you do not recognize or trust.
  • Know what a phishing attack is and how to spot one. visit http://go.middlebury.edu/phish or http://phishing.org
  • If you think you have fallen for a phish change your password. then call x2200
  • If you believe you system is compromised, unplug it from the power and the network. Shut it down immediately. Do not worry about saving your work. then call x2200.
  • Backup your data routinely. If you save your data to Middfiles or your home directory it will be backed up automatically.
  • Never disable your antivirus software.
  • Send any suspect emails to phishing@middlebury.edu
  • Only download software from known vendor sites.
  • Don’t click on ads in web sites. Visit vendor websites directly.

Sources:

Cyber Security Awareness Month

Come listen to experts from across the State speak on new technologies and security topics that impact all of us in our daily lives. Learn how you can fall victim to identity theft. Hear how Google Glass could be the next great technology wave and the next great technology threat. This full day event in Middlebury’s McCullough Social Space will run from 9:00 AM to 4:00 PM on October 9th. For more information please visit http://go.middlebury.edu/CSAM.

Open RoadShow on Information Security

LIS Information Security and the LIS Security Team will be hosting a lunch time RoadShow on information security and basic ways to protect yourself while working on Internet connected computers. This discussion is open to the full College community. Please join us Aug. 28th at noon in Davis Family Library room 145. For more information please visit: http://www.middlebury.edu/offices/technology/infosec/education/CBT/RoadShow

Phishing on campus!

Over the last week Middlebury experienced a dramatic increase in the number of successful phishing attacks that resulted in Middlebury user accounts being compromised. A phishing attack is the effort of maliciously using email or a web site to try to unwittingly gain information about another individual. These recent attacks resulted in two distinct outcomes. The first was that many of these accounts were leveraged to generate large amounts of spam. The second result from these compromised accounts is that the attackers attempted to connect to the Middlebury network with the exposed user’s credentials.

This past week many individuals across our campus received an email that looked similar to the one below:

————————————–

Message with “Middlebury” as the display name

 

Dear Member,

You Have 1 New Message

Click here to read

Sincerely,
Middlebury Webmail Service

————————————

The link in this message redirected people to copy of the Middlebury CAS Logon page. Two important things to know about email from Middlebury IT Services. First, Library and Information Services will never ask for your user credentials in an email. Second, if you find yourself on any web page that is asking for credentials, always verify the address in your web browser’s address bar, to ensure that the web page is where you really want to be. Just because a web page has the Middlebury logo does not mean it is always a Middlebury web site.

To protect against phishing remember the following rules:

  1. Never click on any links in a suspicious email.
  2. If you ever receive an unsolicited email  and you do not recognize the sender delete the message.
  3. If you receive an email that requests your credentials or asks you to click a link which takes you to a web site that requests your credentials, do not click the link but rather go to the web site through the institution home page, Middlebury.edu for example.
  4. If you suspect an email is fraudulent delete the message.
  5. If you ever have questions regarding phishing or the content of an email call the Helpdesk.

The Helpdesk will help you determine if the email is legitimate. Please do NOT click on any links in a suspect email message.

If you suspect that you may have recently provided your Middlebury credentials to a fraudulent web site or email address, you should immediately reset your password at go/activate and then contact the Helpdesk.

If you become aware that your Middlebury account has been disabled, you must contact the Helpdesk to resolve.

More information is available at the Middlebury College Information Security web site at go/infoSec or contact the InfoSec office at infosec@middlebury.edu.

 

Ian Burke

Network Security Administrator

Middlebury College

infosec@middlebury.edu

Sophos Update Issue – False Positive – SHH\Updater-B

On 9-19-12 around 5:40PM Sophos pushed an updated signature file which triggered a false positive virus detections identified as SHH\Updater-B. This signature may have fired on a number of different update files including Flash, Google, and most notably Sophos itself. Sophos has corrected this problem. For additional information please see the security website at http://Go/InfoSec.

Java 7 Update 6 Vulnerability

You may have recently heard or read about a new wide-spread exploit concerning Java in mainstream media outlets. LIS is aware of this risk. The major systems used by the College that depend upon Java (e.g. Banner, Hyperion, Nolij, Famis) use an earlier version of Java and are not vulnerable to this exploit. This vulnerability impacts Java 7 update 6 and possibly other versions of Java 7; Java 6 and below are not vulnerable to this exploit.

Java is used for many different applications and you should be thoughtful about your actions before patching, upgrading or removing your version of Java. While Oracle has released a patch for the current vulnerability it has also opened up a new loophole to a known older vulnerability.

Our advice at this time is to NOT update or patch your Java client to version 7. If your Java client has already been updated or patched to version 7, please remove Java completely from your Mac or Windows computer, and then visit http://java.com/en/download/manual_v6.jsp to reinstall version 6. If you are not sure what version of Java you are running  you may visit this URL to verify, http://www.java.com/en/download/installed.jsp.

LIS continues to remain vigilant in safeguarding our critical systems. If you have questions or concerns regarding this post, please contact infosec@middlebury.edu.

Sophos deployment continues

Last week we began the campus rollout of Sophos Anti-virus; which is replacing the Symantec package we have been using for the past several years. Last week we deployed Sophos to systems which are currently running Windows 7.  This week we will be deploying Sophos to Staff systems have yet to be upgraded. This will be delivered across our network using the same mechanism that manages our Windows workstations. To facilitate this deployment we need to ask that all Windows systems be turned off on Friday nights and powered back up on Monday mornings for the next several weekends. The install packages will be pushed across the network according to the following schedule:

  • February 19th: Windows7 systems
  • February 26th: Remaining  Staff workstations
  • March 4th: Remaining Faculty workstations and computers that have not been addressed in prior groups.

If you should need your system over the weekend and you are off campus there will be no impact to this update. It will resume on Monday as scheduled. If you need your computer and are connected to the campus network (other than through the VPN) you will receive the update when you power your computer on.

For information on Sophos please see the FAQ at http://go/sophos. This will answer many questions you may have and should address any issues you may encounter. Prior to the date your system is scheduled for the Sophos install please do the following:

  • Complete any software installs you may have pending, including any Windows Updates.
  • Disable any additional firewalls you may have added beyond the Windows Firewall. Please note, this is not referring to Anti-virus such as Symantec but rather products such as SonicWall.
  • Shut down your system the Friday before the install so that receives the scheduled install when it powers up on Monday morning.
  • Shut down your system on Monday night (after the scheduled install has occurred).

For additional information please see http://go/sophos